ermac | 85fa90ccb4e51f82fcbd2d20eb6aa05788def9235f7aba979f77a11fdb65df83 | Triage

Sharing

General

Target

85fa90ccb4e51f82fcbd2d20eb6aa05788def9235f7aba979f77a11fdb65df83.bin
Size

3.3MB
Sample

241019-12yp3atfjj
MD5

e1de2024bb46ef51a7403a198ee2a50c
SHA1

59dd12676fb2f6eb53f5976fadc9304aaec9b961
SHA256

85fa90ccb4e51f82fcbd2d20eb6aa05788def9235f7aba979f77a11fdb65df83
SHA512

64306c7d04f9cd4977bb95d7231d42362eeaf3704f3b238c91a0e372e316c0a330cbaeb6aba549fe55875295c1a6947661ca24cd2fd26afd69ad46b14e0d6701
SSDEEP

98304:2ttQSxjZ6K0utb3Ecblg05ao8OYBlePv5VY:2cSdkKxCv0f0

Score

10^/10

ermac android banker discovery evasion infostealer stealth trojan

Malware Config

Targets

- Target
  
  85fa90ccb4e51f82fcbd2d20eb6aa05788def9235f7aba979f77a11fdb65df83.bin
- Size
  
  3.3MB
- MD5
  
  e1de2024bb46ef51a7403a198ee2a50c
- SHA1
  
  59dd12676fb2f6eb53f5976fadc9304aaec9b961
- SHA256
  
  85fa90ccb4e51f82fcbd2d20eb6aa05788def9235f7aba979f77a11fdb65df83
- SHA512
  
  64306c7d04f9cd4977bb95d7231d42362eeaf3704f3b238c91a0e372e316c0a330cbaeb6aba549fe55875295c1a6947661ca24cd2fd26afd69ad46b14e0d6701
- SSDEEP
  
  98304:2ttQSxjZ6K0utb3Ecblg05ao8OYBlePv5VY:2cSdkKxCv0f0
Score

10^/10

ermac banker discovery evasion infostealer stealth trojan
- Ermac
  An Android banking trojan first seen in July 2021.
  banker trojan infostealer ermac
- Ermac2 payload
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries the mobile country code (MCC)
  discovery
behavioral1 behavioral2

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Hide Artifacts

Suppress Application Icon

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ermacbankerdiscoveryevasioninfostealerstealthtrojan

behavioral2

ermacbankerdiscoveryevasioninfostealertrojan